Github actions - how to deploy to remote server using SSH

The answers of felixmosh and Cas but this feels like a better implementation. Rather than uploading your known_hosts file to the Github hosted runners just populate the ~/.ssh/known_hosts file on runtime. More flexible as it might handle issues like IP changing. I tested it and it worked for me.

- name: Write SSH keys
  run: |
    install -m 600 -D /dev/null ~/.ssh/id_rsa
    echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_rsa
    ssh-keyscan -H host.example.com > ~/.ssh/known_hosts

Or, even better,

- name: Write SSH keys
  run: |
    install -m 600 -D /dev/null ~/.ssh/id_rsa
    echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_rsa
    host='host.example.com'
    hosts="$(dig +short "$host" | grep -v '\.$' | sed -z 's|\n|,|g')$host"
    ssh-keyscan -H "$hosts" > ~/.ssh/known_hosts

This ensures that all ips of the host are recorded in known_hosts.

Just replace host.example.com and you are good to go.

felixmosh's answer was useful but I managed to simplify it further using id_rsa that will be automatically used by ssh and the secrets will be substituted without needing intermediary env vars:

  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/download-artifact@v2
        with:
          name: build
          path: build
      - name: Create SSH key
        run: |
          install -m 600 -D /dev/null ~/.ssh/id_rsa
          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_rsa
          echo "${{ secrets.SSH_KNOWN_HOSTS }}" > ~/.ssh/known_hosts
      - name: Deploy with rsync
        run: rsync -rav --delete build/ user@host:/

After several hours of troubleshooting, I finally resolved the issue with automating code deployment using GitHub Actions. Below is the script that you can use by replacing the environment variables with your own.

run: |
      which ssh-agent || (sudo apk update && sudo apk add openssh-client)
      which rsync || (sudo apk update && sudo apk add rsync)
      mkdir -p ~/.ssh
      chmod 700 ~/.ssh
      touch ~/.ssh/private.key
      touch ~/.ssh/known_hosts
      chmod 600 ~/.ssh/private.key
      echo -e "${{ vars.DEV_SSH_PRIVATE_KEY }}" | tr -d '\r' > ~/.ssh/private.key
      # Append keyscan output into known hosts
      ssh-keyscan ${{ vars.DEV_PUBLIC_IP_ADDRESS }} >> ~/.ssh/known_hosts
      chmod 644 ~/.ssh/known_hosts
  - run: |
      eval $(ssh-agent -s)
      ssh-add ~/.ssh/private.key
      echo "Deploy to dev environment"
      rsync --rsync-path=/usr/bin/rsync --delete -avuz --exclude=".*" ./docker-compose/docker-compose-prod.yml ${{ vars.REMOTE_USER }}@${{ vars.DEV_PUBLIC_IP_ADDRESS }}:$BASE_DEV_SERVER_PATH/docker-compose-prod.yml

This is the solution I arrived at:

name: SSH Deployment

on:
  push:
    branches:
      - main

jobs:
  deploy:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4

      - name: Configure SSH
        uses: webfactory/[email protected]
        with:
          ssh-private-key: ${{ secrets.DEPLOY_KEY }}

      - name: Git Pull
        run: |
          cd ${{ github.workspace }}
          ssh-keyscan -t rsa ${{ secrets.SERVER_IP }} >> ~/.ssh/known_hosts
          ssh ${{ secrets.SSH_USER }}@${{ secrets.SERVER_IP }} "cd ${{ secrets.REPO_PATH }} && git pull origin main"
          echo "Successfully pulled repo."

      - name: Check Nginx configuration
        run: |
          echo "Checking nginx config"
          ssh ${{ secrets.SSH_USER }}@${{ secrets.SERVER_IP }} "sudo /usr/sbin/nginx -t 2>&1"
          echo "Nginx configuration check completed."

      - name: Restart Nginx service
        if: success()
        run: |
          ssh ${{ secrets.SSH_USER }}@${{ secrets.SERVER_IP }} "sudo /bin/systemctl restart nginx"
          echo "Nginx service restarted successfully"

If anyone has any notes or comments about security and hardening it would be greatly appreciated. Sharing my solution as I thought it might help someone. Some of the answers here seem overly complicated.